On which OSI layer does the application‑aware firewall block applications on a WAN Edge?

The application-aware firewall operates at Layer 7, the Application Layer of the OSI model. This layer is responsible for providing network services directly to end-user applications. An application-aware firewall inspects the actual application data and protocols (like HTTP, FTP, DNS) to identify and control specific applications, rather than just IP addresses or port numbers. This allows for granular control, such as blocking Facebook while allowing other web traffic. Layer 3 (Network Layer) deals with IP addresses and routing, Layer 5 (Session Layer) manages communication sessions, and Layer 2 (Data Link Layer) handles MAC addresses and physical data transfer; none of these layers provide the necessary visibility into application-specific traffic for an application-aware firewall.